American Airlines: Your order has been completed

We have gotten many reports that this fake American Airlines email has been circulating heavily. Below you will find a sample of the most recent variant. Under no circumstances should you click any links or download any attachments in the message. A Virus Total scan revealed that the email links to a Phishing site.

If you clicked any links, downloaded or opened any attachments, your computer should be immediately scanned for viruses, spyware, malware and other threats.

This entry was posted on Thursday, November 24th, 2011 at 3:02 pm and is filed under Malware.
You can follow any comments to this entry through the RSS 2.0 feed.
You can leave a comment, or trackback from your own site.

I received one today along with two passangers listed with rather different names. I have forwarde on to American Airlines and I have not seen any charges hit my credit cards as of yet. Anyone have any other suggestions for me?

WHAT i LOVE ABOUT THESE SCAMMERS . YOU NEVER SEE YOUR NAME ON ANYTHING SO THAT TELLS ME IT'S A SCAM PLUS THEY SENT IT TO AN E-MAIL ADDRESS THAT I HARDLY USE. SO SORRY SCAMMERS I WILL NOT DOWNLOAD A FAKE AIRLINE TICKET SO I CAN PICK UP THE FAKE PACKAGE WAITING FOR ME FROM FED-EX CAUSE THEY CANNOT FIND MY ADDRESS WITH THE MILLIONS I WON FROM A LOTTERY IN A DIFFERENT COUNTRY. PLUS ALL THESE FAKE E-MAILS THAT SAY I OWE MONEY OR I WILL BE ARRESTED I WILL SENT AN E-MAIL THAT SAID I WON MILLONS AND YOU CAN COLLECT FROM THEM

got this same email today, but google'd this blog before opening the attached download. At first i thought i was victim of identity theft. Evidently this is just a scam, deleting now....Thanks everyone!

Got 2 on the same day 4/15/13 , one was in my spam mail("Your Order#23016411") the other was in my inbox("Your Order#41284 has been completed). Both of them were 'American Airlines' scams and NO i did NOT click on the links..

I don't know why you guys arn't warning people about the flood of fake facebook e-mails which sez 'facebook.com/admin/" when a mouse over shows the URL is some virus infected site. I've had 5 of these in 2 days on hotmail. Tracking them back to the server, shows them coming from the east coast USA. DOS flooded them for 24HRs with 1000 threads - I think they got the message. Still getting them from different public servers and specific sub-directories. You can fake it, but I find you you Moth*** Fu*****

When I get an email with a down load or attachment and I do not know the sender I return it with a note saying I can not download or open attachments on this computer. Please open and return, So far I have not received anything back

I have received two of these emails never flew with AA and I am deleting these. One was a flight to Columbus. It is only three hour drive away from were I live why would I fly there. The other is to San Diego. Both emails have same price...how could that be 393.93 to fly to Columbus and San Diego. Total scam. I also found this on AA.com website:
What To Do If You Receive a Phishing Email, Fax, Contract or Postal Mailing
American Airlines will never ask you to perform security-related changes to your account in this fashion or send emails to collect user names, passwords, email addresses or other personal information. If you receive an email claiming to be from American Airlines, that asks for account information, it should be considered fraudulent and an attempt to obtain personal information that may be used to commit fraud.
If you receive this type of email, do not click on any links, open any attachments, call any phone numbers listed or follow any instructions in the email. Instead, forward a copy of the email, including the header to webmaster@aa.com so that we can investigate further.

I recieved one today April 13, 2013 with the subject "Your Order#46394 has been completed" It was sent from the address: client-796[@]ticketwest.com. Nothing was charged from my account.
I am glad I googled and found this site. I was worried it was stolen identity but now I know its spam. I´m deleting the mail right now.

I got one today, subject line was very convincing "Your Order#92114 has been completed"; from an address: service-498[@]onlineticketsales.com; There was an attached file that wanted me to download if I was to use the ticket, but luckily I discarded it. I immediately checked my credit card accounts, and thankfully there were no charges of any flight, so it's definitely a scam.

I received a similar email tonight. It asked me to "pleace" use their password to open an attached .rar file. The flight booked, Aurora IL, was dated this past June. The sender address from "a-airlines.com" which Google reveals isn't even a real website. Scammers are getting lazy.

Got the same e-mail October 31, 2012, but it said it was from Delta Airlines (which was confusing because I am actually booked on a flight with Delta). This was a definitely a scam though, so I deleted without opening the attachment.

Got this one today and, like others mentioned, I was concerned about possible ID theft. I know better than to open any attachments, so I was going to just try calling American Airlines, but thought I'd Google the subject line first and found this. My "tickets" were from American Airlines to Vegas.

Just got ocom to my work account from Delta Airlines. Confusing because it comes from delta.com
Sending me to Denver from unknown location. Dear Customer, not personal address.
Thought my skymiles had been hacked. Obviously didn't open zip file but looked legit at first.

Received a similar email last night...There were no attachments sent with the email. I found this website listing received scams and called American Airlines just to double verify and she confirmed this is a scam and not to open any attachments.

Received this email and thought it was my grandmother-in-law's ticket because I used my email as a confirmation, she cancelled and got credit and I thought she had scheduled another flight. I opened it, and then my web browser stopped working because it said it has been infected. I restarted the computer and was able to get the browser to work again. This is a work computer. They have plans anyways to renew the virus software tomorrow, so hopefully this won't do much damage.

@keith If you look at the header info, you will see that these emails are being generated from numberous sites, but aren't from aa.com (it's called "spoofing". A trick to protect yourself is to look at the header information, as well viewing the source code of the email (i.e., "VIEW SOURCE". Invariably, the links are exposed as bogus, the sender is not who it seems. Needless to say, NEVER open attachments!!